It looks like something happened overnight last night and the patch became visible after I posted. You may want to update the docs to include zsh and ksh as sh

It looks like something happened overnight last night and the patch became visible after I posted. You may want to update the docs to include zsh and ksh as shells that you will use since shouldLoadShellEnvvars checks for all three. I found a place where back ticks are used to get something done: file lib/phusion_passenger/platform_info/apache.rb, method httpd_infer_envvar. If Passenger somehow gets a corrupted environment and calls httpd_infer_envvar then it would trip over Shellshock on an unpatched system. I didn't search generally for back ticks or other shell entry points, but you may want to remove extraneous shell invocations as a future proofing step against other vulnerabilities showing up in shells. (I know, you said that was insane, but so was all of yesterday :)